   ([{:keys [api-root http-timeout user-id-cache connection-manager] :as keycloak} email
     {:keys [timeout] :or {timeout http-timeout}}]
    (let [bare-req-opts {:timeout timeout}]
-     (when-some [headers (request-headers keycloak bare-req-opts)]
-       (let [req-opts (assoc bare-req-opts :headers headers)]
-         (when-let [user-id (lookup-user-id connection-manager req-opts api-root user-id-cache email)]
-           (when-let [allowed-paths
-                    (-> (client/get (format "%s/users/%s/groups" api-root user-id)
-                                    (assoc req-opts :connection-manager connection-manager)) :body json/decode)]
-             (reduce (fn [paths {:strs [path]}]
-                       (conj paths (subs path 12)))
-                     #{}
-                     allowed-paths))))))))
+     (when-let [headers (request-headers keycloak bare-req-opts)]
+       (let [req-opts (assoc bare-req-opts :headers headers :connection-manager connection-manager)]
+         (when-let [user-id (lookup-user-id req-opts api-root user-id-cache email)]
+           (->> (client/get (format "%s/users/%s/groups" api-root user-id) req-opts )
+                :body
+                json/decode
+                (reduce (fn [paths {:strs [path]}]
+                          (conj paths (subs path 12)))
+                        #{}))))))))
 
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

   (let [params (merge {:grant_type "client_credentials"}
                       credentials)
         resp (client/post (get openid-config "token_endpoint")
                           {:form-params params})
         access-token (-> resp :body json/decode (get "access_token"))]
     {"Authorization" (str "bearer " access-token)
      "Content-Type" "application/json"}))
  ([{:keys [openid-config credentials connection-manager]}
    {:keys [timeout] :as req-opts}]
   (let [params (merge {:grant_type "client_credentials"}

         req-opts (-> req-opts
                      (select-keys [:timeout])
                      (assoc :form-params params))]
     (when-let [access-token (-> (client/post url (assoc req-opts :connection-manager connection-manager))
                                 :body
                                 json/decode
                                 (get "access_token"))]
       {"Authorization" (str "bearer " access-token)
        "Content-Type" "application/json"}))))

